Executive brief
nono-py is a Python library used to run code in a restricted sandbox environment. A vulnerability in how it handles security policies allows sandboxed applications to bypass network restrictions and access the internet directly instead of through a controlled proxy. This could lead to unauthorized data transmission or access to internal network resources that should have been blocked.
Technical details
nono-py's policy handling contains two primary flaws that lead to a 'fail open' state. First, the resolution of policy-derived ProxyConfig objects did not automatically enforce CapabilitySet.proxy_only, allowing sandboxed child processes to bypass domain allowlists via direct network access. Second, the policy JSON parser accepted unknown fields without error, meaning misspelled or unsupported security restrictions were silently ignored. On Linux, the fix involves utilizing Landlock ABI v4 or a seccomp supervisor fallback to intercept and validate connect and bind syscalls. Attackers with the ability to execute code within the sandbox can exploit this to reach unauthorized network destinations. The vulnerability is addressed in version 0.10.1.
Affected products
- nolabs-ai nono-py <= 0.10.0
Timeline
- 2026-05-23: disclosed
- 2026-06-26: advisory: GitHub Advisory published
- 2026-05-23: patched: Fixes committed to repository
References
- https://github.com/always-further/nono-py/security/advisories/GHSA-m8j6-rc5x-wv36
- https://github.com/nolabs-ai/nono-py/commit/2897ee20df0d75afd298d94840b9d135b3b3a6e9
- https://github.com/nolabs-ai/nono-py/commit/807fb4bce2385b9e88185bf160e0792b588813c7
- https://api.github.com/repos/nolabs-ai/nono-py/security-advisories/GHSA-m8j6-rc5x-wv36